CISA says WordPress flaw is being exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) says attackers are exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, stems from a time-of-check to time-of-use (TOCTOU) race condition. Picus Security researcher Umut Bayram reported it.

Successful exploitation can let remote attackers with no privileges execute code on a server. The attacks are high-complexity and rely on predictable, web-accessible staging paths during full-package core upgrades. WordPress’s security team described the issue as a weakness that could enable remote code execution during the upgrade window. It released WordPress 7.1.4 on October 28 to patch the flaw and recommended that site operators update immediately.

On Tuesday, CISA confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. It ordered Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Friday under Binding Operational Directive (BOD) 26-04. CISA also urged network defenders, including those in the private sector, to prioritize patching. The agency did not provide further details about the attacks.

WordPress security firm Wordfence said in an advisory update over the weekend that it had blocked 13,095 attacks targeting the flaw in the past 24 hours.

The report follows other WordPress Core security incidents. In July, the security team patched the wp2shell vulnerability chain, involving CVE-2026-63030 and CVE-2026-60137. Public exploits appeared one day after the patches, and attackers began breaching unpatched servers a few days later. In September, a Chinese-speaking threat actor used the chain to steal sensitive data from more than 18,500 records in databases belonging to small businesses and government organizations.